Project Blitzkrieg e-banking heist is a credible threat, McAfee says
McAfee has detected malware activity linked to an online fraud operation allegedly planned by cybercriminals
IDG News Service - Project Blitzkrieg, a coordinated attack against U.S. banking customers allegedly planned for the spring of 2013, is a real and credible threat, security researchers at McAfee have said.
A cybercriminal using the nickname "vorVzakone" announced the plan back in September on a semi-private Russian-language underground forum and invited others to join the project. The goal was to create a network of separate cybercriminal gangs that work together using the same malware and resources for a cut of the profits.
VorVzakone said at the time that the operation will target the customers of 30 U.S. banks using a Trojan program that has been in development since 2008 and has more functionality than Zeus or SpyEye -- crimeware toolkits commonly used to steal money from online banking accounts.
In a report about Project Blitzkrieg released in October, security researchers from RSA said that VorVzakone's Trojan program is based on an older piece of malware called Gozi. RSA dubbed the new variant Gozi Prinimalka.
The ambitious nature of Project Blitzkrieg and the way it was advertised has led to speculation that it's probably part of a law enforcement sting operation. However, after investigating the Gozi Prinimalka malware, security researchers from McAfee believe the project is authentic and the threat is real.
In a new report published Thursday, they reveal there are two main Prinimalka versions: one dubbed "nah" that dates back to 2008, lending credibility to VorVzakone's claim that the Trojan program has been in development since 2008, and one dubbed "gov" that first appeared in April 2012 and was probably used as a pilot for Project Blitzkrieg.
According to McAfee's report, older attack campaigns based on the "nah" version primarily used command and control servers hosted in the Ukraine, while the more recent attack campaigns based on the "gov" version used servers hosted in Romania,
The first "gov" Prinimalka campaign using servers in Romania started in early August 2012 and the latest one started in October. All of them targeted the customers of U.S. banks.
Based on McAfee telemetry data, the latest activity seen from the October Prinimalka campaign was on Nov. 30, Ryan Sherstobitoff, a McAfee Labs researcher, said Thursday. The fact that a campaign started in October suggests that the project is moving forward, he said.
Several hundred computers in the U.S. are currently infected with Gozi Prinimalka, Sherstobitoff said. It's not clear if attackers are already stealing money from victims' bank accounts, but it's certainly possible, he said.
That said, not everyone whose computer gets infected with the malware will automatically become a victim of bank fraud. The attackers will likely identify the most valuable accounts and focus on those, Sherstobitoff said.
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Advanced Threat Defense: A Comprehensive Approach In this interview, Peter George, president, General Dynamics Fidelis Cybersecurity Solutions, explains why we need more than anti-malware, and what constitutes a comprehensive...
- 2013 Cyber Risk Report The "Cyber risk report 2013 Executive summary" presents the major findings of HP Security Research's comprehensive dive into today's cyber vulnerability and threat...
- Cybersecurity for Dummies eBook This book provides an in-depth examination of real-world attacks and APTs, the shortcomings of legacy security solutions, the capabilities of next-generation firewalls, and...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different.... All Cybercrime and Hacking White Papers | Webcasts